CVE-2025-28903
Published: 26 March 2025
Summary
CVE-2025-28903 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Spearphishing Link (T1566.002); ranked at the 42.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-28903 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the hectorgarrofe Driving Directions (ddirections) WordPress plugin. This issue affects all versions of the plugin from n/a through 1.4.4, as published on 2025-03-26.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility with low attack complexity, no required privileges, and user interaction needed. Remote attackers can exploit it by crafting malicious inputs that reflect XSS payloads in web page generation, tricking authenticated users (such as site visitors or admins) into interacting via a malicious link or input. Exploitation enables limited impacts on confidentiality, integrity, and availability, with a changed scope (S:C) allowing cross-origin execution, potentially leading to session token theft or malicious script injection in the victim's browser.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/ddirections/vulnerability/wordpress-driving-directions-plugin-1-4-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, which covers the Reflected XSS in the WordPress Driving Directions plugin version 1.4.4.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8145
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hectorgarrofe Driving Directions ddirections allows Reflected XSS.This issue affects Driving Directions: from n/a through <= 1.4.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS enables crafting malicious links (T1566.002) that trick users into clicking to execute injected scripts in browser (T1204.001), leading to session theft or further actions.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses improper neutralization of input during web page generation by requiring output filtering to prevent reflected XSS payloads from executing in the ddirections WordPress plugin.
Mandates validation of user-supplied inputs to block malicious scripts before reflection in responses from the vulnerable Driving Directions plugin.
Ensures timely identification, reporting, and patching of the reflected XSS flaw affecting ddirections plugin versions through 1.4.4.